diff --git a/cups-lspp.patch b/cups-lspp.patch index 23e4036..5697edb 100644 --- a/cups-lspp.patch +++ b/cups-lspp.patch @@ -1,5 +1,5 @@ ---- cups-1.2.2-8/config.h.in 2006-08-10 11:42:42.000000000 -0400 -+++ cups-1.2.2/config.h.in 2006-08-07 06:19:33.000000000 -0400 +--- cups-1.2.4-orig/config.h.in 2006-06-05 14:42:53.000000000 -0400 ++++ cups-1.2.4/config.h.in 2006-09-28 16:31:29.000000000 -0400 @@ -443,6 +443,13 @@ #undef HAVE_APPLETALK_AT_PROTO_H @@ -14,8 +14,8 @@ #endif /* !_CUPS_CONFIG_H_ */ /* ---- cups-1.2.2-8/configure.in 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/configure.in 2006-08-07 06:19:33.000000000 -0400 +--- cups-1.2.4-orig/configure.in 2006-08-04 12:51:58.000000000 -0400 ++++ cups-1.2.4/configure.in 2006-09-28 16:31:29.000000000 -0400 @@ -47,6 +47,8 @@ sinclude(config-scripts/cups-pdf.m4) sinclude(config-scripts/cups-scripting.m4) @@ -25,8 +25,8 @@ INSTALL_LANGUAGES="" UNINSTALL_LANGUAGES="" LANGFILES="" ---- cups-1.2.2-8/config-scripts/cups-lspp.m4 1969-12-31 19:00:00.000000000 -0500 -+++ cups-1.2.2/config-scripts/cups-lspp.m4 2006-08-07 06:19:33.000000000 -0400 +--- cups-1.2.4-orig/config-scripts/cups-lspp.m4 1969-12-31 19:00:00.000000000 -0500 ++++ cups-1.2.4/config-scripts/cups-lspp.m4 2006-09-28 16:31:29.000000000 -0400 @@ -0,0 +1,36 @@ +dnl +dnl LSPP code for the Common UNIX Printing System (CUPS). @@ -64,18 +64,19 @@ + ;; + esac +fi ---- cups-1.2.2-8/cups/cups.h 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/cups/cups.h 2006-08-07 06:19:33.000000000 -0400 -@@ -24,6 +24,8 @@ +--- cups-1.2.4-orig/cups/cups.h 2006-09-07 15:49:34.000000000 -0400 ++++ cups-1.2.4/cups/cups.h 2006-09-28 16:31:29.000000000 -0400 +@@ -24,6 +24,9 @@ * This file is subject to the Apple OS-Developed Software exception. */ +/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */ ++/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ + #ifndef _CUPS_CUPS_H_ # define _CUPS_CUPS_H_ -@@ -68,6 +70,12 @@ +@@ -68,6 +71,12 @@ # define CUPS_DATE_ANY -1 @@ -88,8 +89,8 @@ /* * Types and structures... */ ---- cups-1.2.2-8/data/Makefile 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/data/Makefile 2006-08-07 06:19:33.000000000 -0400 +--- cups-1.2.4-orig/data/Makefile 2006-03-18 22:23:34.000000000 -0500 ++++ cups-1.2.4/data/Makefile 2006-09-28 16:31:29.000000000 -0400 @@ -34,7 +34,10 @@ secret \ standard \ @@ -102,8 +103,8 @@ CHARMAPS = \ euc-cn.txt \ ---- cups-1.2.2-8/data/mls 1969-12-31 19:00:00.000000000 -0500 -+++ cups-1.2.2/data/mls 2006-08-07 06:19:33.000000000 -0400 +--- cups-1.2.4-orig/data/mls 1969-12-31 19:00:00.000000000 -0500 ++++ cups-1.2.4/data/mls 2006-09-28 16:31:29.000000000 -0400 @@ -0,0 +1,277 @@ +%!PS-Adobe-3.0 +%%BoundingBox: 0 0 612 792 @@ -382,8 +383,8 @@ +% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $". +% +%%EOF ---- cups-1.2.2-8/data/selinux 1969-12-31 19:00:00.000000000 -0500 -+++ cups-1.2.2/data/selinux 2006-08-07 06:19:33.000000000 -0400 +--- cups-1.2.4-orig/data/selinux 1969-12-31 19:00:00.000000000 -0500 ++++ cups-1.2.4/data/selinux 2006-09-28 16:31:29.000000000 -0400 @@ -0,0 +1,277 @@ +%!PS-Adobe-3.0 +%%BoundingBox: 0 0 612 792 @@ -662,8 +663,8 @@ +% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $". +% +%%EOF ---- cups-1.2.2-8/data/te 1969-12-31 19:00:00.000000000 -0500 -+++ cups-1.2.2/data/te 2006-08-07 06:19:33.000000000 -0400 +--- cups-1.2.4-orig/data/te 1969-12-31 19:00:00.000000000 -0500 ++++ cups-1.2.4/data/te 2006-09-28 16:31:29.000000000 -0400 @@ -0,0 +1,277 @@ +%!PS-Adobe-3.0 +%%BoundingBox: 0 0 612 792 @@ -942,8 +943,8 @@ +% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $". +% +%%EOF ---- cups-1.2.2-8/Makedefs.in 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/Makedefs.in 2006-08-07 06:19:33.000000000 -0400 +--- cups-1.2.4-orig/Makedefs.in 2006-09-28 11:38:14.000000000 -0400 ++++ cups-1.2.4/Makedefs.in 2006-09-28 16:31:29.000000000 -0400 @@ -135,7 +135,7 @@ @LDFLAGS@ @RELROFLAG@ @PIEFLAGS@ $(OPTIM) LINKCUPS = @LINKCUPS@ $(SSLLIBS) @@ -953,9 +954,9 @@ OPTIM = @OPTIM@ OPTIONS = PAMLIBS = @PAMLIBS@ ---- cups-1.2.2-8/scheduler/client.c 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/scheduler/client.c 2006-08-07 06:19:33.000000000 -0400 -@@ -43,12 +43,17 @@ +--- cups-1.2.4-orig/scheduler/client.c 2006-09-19 16:44:07.000000000 -0400 ++++ cups-1.2.4/scheduler/client.c 2006-10-02 12:44:13.000000000 -0400 +@@ -44,12 +44,17 @@ * make_certificate() - Make a self-signed SSL/TLS certificate. * pipe_command() - Pipe the output of a command to the remote client. * write_file() - Send a file via HTTP. @@ -973,19 +974,20 @@ #include #include "cupsd.h" -@@ -64,6 +69,11 @@ +@@ -65,6 +70,12 @@ # include #endif /* HAVE_GNUTLS */ +#ifdef WITH_LSPP +#include ++#include +#include +#endif /* WITH_LSPP */ + /* * Local functions... -@@ -380,6 +390,53 @@ +@@ -381,6 +392,53 @@ "cupsdAcceptClient: %d connected to server on %s:%d", con->http.fd, con->servername, con->serverport); @@ -1039,15 +1041,55 @@ /* * Using TCP_NODELAY improves responsiveness, especially on systems * with a slow loopback interface... Since we write large buffers -@@ -3465,7 +3522,6 @@ - time_t curtime; /* Current time */ - int result; /* Result of GNU TLS calls */ +@@ -711,6 +769,11 @@ + mime_type_t *type; /* MIME type of file */ + cupsd_printer_t *p; /* Printer */ + static unsigned request_id = 0; /* Request ID for temp files */ ++#ifdef WITH_LSPP ++ security_context_t spoolcon; /* context of the job file */ ++ context_t clicon; /* contex_t container for con->scon */ ++ context_t tmpcon; /* temp context to swap the level */ ++#endif /* WITH_LSPP */ -- - /* - * Create the encryption key... - */ -@@ -3664,6 +3720,49 @@ + + status = HTTP_CONTINUE; +@@ -1797,6 +1860,35 @@ + fchmod(con->file, 0640); + fchown(con->file, RunUser, Group); + fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC); ++#ifdef WITH_LSPP ++ if (getfilecon(con->filename, &spoolcon) == -1) ++ { ++ cupsdSendError(con, HTTP_SERVER_ERROR); ++ freecon(spoolcon); ++ return (cupsdCloseClient(con)); ++ } ++ clicon = context_new(con->scon); ++ tmpcon = context_new(spoolcon); ++ freecon(spoolcon); ++ if (context_range_set(tmpcon, (context_range_get(clicon))) == -1) ++ { ++ cupsdSendError(con, HTTP_SERVER_ERROR); ++ context_free(tmpcon); ++ context_free(clicon); ++ return (cupsdCloseClient(con)); ++ } ++ if (setfilecon(con->filename, context_str(tmpcon)) == -1) ++ { ++ cupsdSendError(con, HTTP_SERVER_ERROR); ++ context_free(tmpcon); ++ context_free(clicon); ++ return (cupsdCloseClient(con)); ++ } ++ cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadClient: %s set to %s", ++ con->filename, context_str(tmpcon)); ++ context_free(tmpcon); ++ context_free(clicon); ++#endif /* WITH_LSPP */ + } + + if (con->http.state != HTTP_POST_SEND) +@@ -3810,6 +3902,49 @@ #endif /* HAVE_SSL */ @@ -1097,8 +1139,8 @@ /* * 'pipe_command()' - Pipe the output of a command to the remote client. */ ---- cups-1.2.2-8/scheduler/client.h 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/scheduler/client.h 2006-08-07 06:19:33.000000000 -0400 +--- cups-1.2.4-orig/scheduler/client.h 2006-09-11 10:21:23.000000000 -0400 ++++ cups-1.2.4/scheduler/client.h 2006-09-28 16:31:29.000000000 -0400 @@ -22,6 +22,13 @@ * WWW: http://www.cups.org */ @@ -1124,7 +1166,7 @@ }; #define HTTP(con) &((con)->http) -@@ -118,6 +129,9 @@ +@@ -119,6 +130,9 @@ extern void cupsdStopListening(void); extern void cupsdUpdateCGI(void); extern int cupsdWriteClient(cupsd_client_t *con); @@ -1134,8 +1176,8 @@ /* ---- cups-1.2.2-8/scheduler/conf.c 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/scheduler/conf.c 2006-08-14 06:09:33.000000000 -0400 +--- cups-1.2.4-orig/scheduler/conf.c 2006-09-28 11:38:08.000000000 -0400 ++++ cups-1.2.4/scheduler/conf.c 2006-09-29 18:23:37.000000000 -0400 @@ -35,6 +35,7 @@ * read_configuration() - Read a configuration file. * read_location() - Read a definition. @@ -1174,15 +1216,7 @@ /* -@@ -377,6 +387,7 @@ - } - } - -+ - /* - * Numeric options... - */ -@@ -470,6 +481,16 @@ +@@ -470,6 +480,16 @@ RunUser = getuid(); @@ -1199,7 +1233,12 @@ /* * See if the ServerName is an IP address... */ -@@ -779,7 +800,19 @@ +@@ -777,11 +797,23 @@ + if (MaxActiveJobs > (MaxFDs / 3)) + MaxActiveJobs = MaxFDs / 3; + +- if (Classification && !strcasecmp(Classification, "none")) ++ if (Classification && strcasecmp(Classification, "none") == 0) cupsdClearString(&Classification); if (Classification) @@ -1209,7 +1248,7 @@ + if (AuditLog != -1) + { + audit_message = NULL; -+ cupsdSetStringf(&audit_message, "[Config] Security level=%s", Classification); ++ cupsdSetStringf(&audit_message, "[Config] Classification=%s", Classification); + audit_log_user_message(AuditLog, AUDIT_LABEL_LEVEL_CHANGE, audit_message, + ServerName, NULL, NULL, 1); + free(audit_message); @@ -1219,15 +1258,7 @@ /* * Update the MaxClientsPerHost value, as needed... -@@ -2233,7 +2266,6 @@ - - cupsd_dirsvc_addr_t *dira; /* New browse address array */ - -- - if (NumBrowsers == 0) - dira = malloc(sizeof(cupsd_dirsvc_addr_t)); - else -@@ -3286,6 +3318,18 @@ +@@ -3295,6 +3327,18 @@ return (0); } @@ -1245,18 +1276,10 @@ + /* - * End of "$Id: conf.c 5736 2006-07-13 19:59:36Z mike $". ---- cups-1.2.2-8/scheduler/conf.h 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/scheduler/conf.h 2006-08-07 06:19:33.000000000 -0400 -@@ -182,7 +182,6 @@ - /* Number of MIME types */ - VAR const char **MimeTypes VALUE(NULL); - /* Array of MIME types */ -- - #ifdef HAVE_SSL - VAR char *ServerCertificate VALUE(NULL); - /* Server certificate file */ -@@ -191,6 +190,10 @@ + * End of "$Id: conf.c 5905 2006-08-29 20:48:59Z mike $". +--- cups-1.2.4-orig/scheduler/conf.h 2006-09-28 11:38:08.000000000 -0400 ++++ cups-1.2.4/scheduler/conf.h 2006-09-28 16:31:29.000000000 -0400 +@@ -191,6 +191,10 @@ /* Server key file */ # endif /* HAVE_LIBSSL || HAVE_GNUTLS */ #endif /* HAVE_SSL */ @@ -1267,7 +1290,7 @@ #ifdef HAVE_LAUNCHD VAR int LaunchdTimeout VALUE(DEFAULT_TIMEOUT); -@@ -213,6 +216,9 @@ +@@ -213,6 +217,9 @@ ; extern int cupsdLogPage(cupsd_job_t *job, const char *page); @@ -1277,8 +1300,8 @@ /* * End of "$Id: conf.h 5696 2006-06-26 18:34:20Z mike $". ---- cups-1.2.2-8/scheduler/ipp.c 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/scheduler/ipp.c 2006-08-21 06:57:47.000000000 -0400 +--- cups-1.2.4-orig/scheduler/ipp.c 2006-09-28 11:38:08.000000000 -0400 ++++ cups-1.2.4/scheduler/ipp.c 2006-10-02 12:44:13.000000000 -0400 @@ -96,6 +96,9 @@ * validate_user() - Validate the user for the request. */ @@ -1304,26 +1327,29 @@ /* * PPD default choice structure... -@@ -1166,6 +1177,18 @@ +@@ -1173,6 +1184,21 @@ int kbytes; /* Size of print file */ int i; /* Looping var */ int lowerpagerange; /* Page range bound */ +#ifdef WITH_LSPP -+ char *argv[3]; /* Command line args */ -+ char *envp[MAX_ENV]; /* Environment */ + char *audit_message; /* Audit message string */ -+ char buffer[1024] = {0}; /* argv[0] buffer */ -+ int acstatus; /* return value of the access check */ -+ pid_t acpid; /* pid for the access check */ + char *printerfile; /* device file pointed to by the printer */ + char *userheader = NULL; /* User supplied job-sheets[0] */ + char *userfooter = NULL; /* User supplied job-sheets[1] */ + int override = 0; /* Was a banner overrode on a job */ ++ security_id_t clisid; /* SELinux SID for the client */ ++ security_id_t psid; /* SELinux SID for the printer */ ++ context_t printercon; /* Printer's context string */ ++ security_context_t devcon; /* Printer's SELinux context */ ++ struct av_decision avd; /* Pointer to the access decision */ ++ struct avc_entry_ref avcref; /* Pointer to the access vector cache */ ++ security_class_t tclass; /* Object class for the SELinux check */ ++ access_vector_t avr; /* Access method being requested */ +#endif /* WITH_LSPP */ cupsdLogMessage(CUPSD_LOG_DEBUG2, "add_job(%p[%d], %s)", con, -@@ -1342,6 +1365,90 @@ +@@ -1349,6 +1375,93 @@ return (NULL); } @@ -1357,55 +1383,58 @@ + */ + + printerfile = strstr(printer->device_uri, "/dev/"); ++ if (printerfile == NULL && (strncmp(printer->device_uri, "file:/", 6) == 0)) ++ printerfile = strdup(printer->device_uri + strlen("file:/")); ++ + if (printerfile != NULL) + { + cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: Attempting an access check on printer device %s", + printerfile); + -+ if (setexeccon(job->scon) != 0) ++ tclass = SECCLASS_FILE; ++ avr = FILE__WRITE; ++ avc_init("cupsd_enqueue_", NULL, NULL, NULL, NULL); ++ avc_entry_ref_init(&avcref); ++ if (avc_context_to_sid(con->scon, &clisid) != 0) + { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "add_job: Unable to setexeccon to %s", job->scon); -+ send_ipp_status(con, IPP_INTERNAL_ERROR, _("Internal SELinux error")); ++ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux sid of the client")); + return (NULL); + } ++ if (getfilecon(printerfile, &devcon) == -1) ++ { ++ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux context of the printer")); ++ return (NULL); ++ } ++ printercon = context_new(devcon); ++ cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: printer context %s client context %s", ++ context_str(printercon), con->scon); ++ context_free(printercon); + -+ snprintf(buffer, sizeof(buffer), "%s/daemon/lspp-access", ServerBin); -+ argv[0] = "lspp-access"; -+ argv[1] = printerfile; -+ argv[2] = NULL; -+ -+ cupsdLoadEnv(envp, (int)(sizeof(envp) / sizeof(envp[0]))); -+ -+ if (!cupsdStartProcess(buffer, argv, envp, -1, -1, -1, -1, 0, &acpid)) ++ if (avc_context_to_sid(devcon, &psid) != 0) + { -+ waitpid(acpid, &acstatus, 0); -+ if (WIFEXITED(acstatus)) ++ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux sid of the printer")); ++ freecon(devcon); ++ return (NULL); ++ } ++ freecon(devcon); ++ if (avc_has_perm_noaudit(clisid, psid, tclass, avr, &avcref, &avd) != 0) ++ { ++ /* ++ * The access check failed, so cancel the job and send an audit message ++ */ ++ if (AuditLog != -1) + { -+ if (WEXITSTATUS(acstatus) != 0) -+ { -+ /* -+ * The access check failed, so cancel the job and send an audit message -+ */ -+ if (AuditLog != -1) -+ { -+ audit_message = NULL; -+ cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s obj=%s refused," -+ "unable to access printer=%s", job->id, con->auid, -+ con->username, con->scon, printer->name); -+ audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message, -+ ServerName, NULL, NULL, 0); -+ free(audit_message); -+ } -+ -+ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("SELinux prohibits access to the printer")); -+ return (NULL); -+ } -+ else -+ { -+ cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: access check succeeded (returned %d)", -+ WEXITSTATUS(acstatus)); -+ } ++ audit_message = NULL; ++ cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s obj=%s refused" ++ " unable to access printer=%s", job->id, con->auid, ++ con->username, con->scon, printer->name); ++ audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message, ++ ServerName, NULL, NULL, 0); ++ free(audit_message); + } ++ ++ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("SELinux prohibits access to the printer")); ++ return (NULL); + } + } + } @@ -1414,7 +1443,7 @@ job->dtype = dtype; job->attrs = con->request; con->request = NULL; -@@ -1537,6 +1644,29 @@ +@@ -1544,6 +1657,29 @@ attr->values[0].string.text = _cupsStrAlloc(printer->job_sheets[0]); attr->values[1].string.text = _cupsStrAlloc(printer->job_sheets[1]); } @@ -1444,7 +1473,7 @@ job->job_sheets = attr; -@@ -1567,6 +1697,9 @@ +@@ -1574,6 +1710,9 @@ "job-sheets=\"%s,none\", " "job-originating-user-name=\"%s\"", job->id, Classification, job->username); @@ -1454,7 +1483,7 @@ } else if (attr->num_values == 2 && strcmp(attr->values[0].string.text, -@@ -1585,6 +1718,9 @@ +@@ -1592,6 +1731,9 @@ "job-originating-user-name=\"%s\"", job->id, attr->values[0].string.text, attr->values[1].string.text, job->username); @@ -1464,7 +1493,7 @@ } else if (strcmp(attr->values[0].string.text, Classification) && strcmp(attr->values[0].string.text, "none") && -@@ -1605,6 +1741,9 @@ +@@ -1612,6 +1754,9 @@ "job-originating-user-name=\"%s\"", job->id, attr->values[0].string.text, attr->values[1].string.text, job->username); @@ -1474,7 +1503,7 @@ } } else if (strcmp(attr->values[0].string.text, Classification) && -@@ -1645,9 +1784,52 @@ +@@ -1652,9 +1797,52 @@ "job-sheets=\"%s\", " "job-originating-user-name=\"%s\"", job->id, Classification, job->username); @@ -1494,8 +1523,8 @@ + /* + * The user overrode the banner, so audit it + */ -+ cupsdSetStringf(&audit_message, "job=%d user supplied classification \"%s\" \"%s\"" -+ " using \"%s\" \"%s\"", job->id, userheader, ++ cupsdSetStringf(&audit_message, "job=%d user supplied job-sheets=%s,%s" ++ " using banners=%s,%s", job->id, userheader, + userfooter, attr->values[0].string.text, + (attr->num_values > 1) ? attr->values[1].string.text : "(null)"); + audit_log_user_message(AuditLog, AUDIT_LABEL_OVERRIDE, audit_message, @@ -1506,8 +1535,8 @@ + /* + * The user tried to override the banner, audit the failure + */ -+ cupsdSetStringf(&audit_message, "job=%d user supplied classification \"%s\" \"%s\"" -+ ", ignored using \"%s\" \"%s\"", job->id, userheader, ++ cupsdSetStringf(&audit_message, "job=%d user supplied job-sheets=%s,%s" ++ " ignored banners=%s,%s", job->id, userheader, + userfooter, attr->values[0].string.text, + (attr->num_values > 1) ? attr->values[1].string.text : "(null)"); + audit_log_user_message(AuditLog, AUDIT_LABEL_OVERRIDE, audit_message, @@ -1527,19 +1556,65 @@ /* * See if we need to add the starting sheet... */ -@@ -3501,6 +3683,11 @@ +@@ -3504,6 +3692,13 @@ char attrname[255], /* Name of attribute */ *s; /* Pointer into name */ ipp_attribute_t *attr; /* Attribute */ +#ifdef WITH_LSPP + const char *mls_label = NULL; /* SL of print job */ -+ context_t job_context; /* SELinux context of the job */ ++ context_t jobcon; /* SELinux context of the job */ ++ context_t tmpcon; /* Temp context to set the level */ ++ security_context_t spoolcon; /* Context of the file in the spool */ +#endif /* WITH_LSPP */ + cupsdLogMessage(CUPSD_LOG_DEBUG2, "copy_banner(%p[%d], %p[%d], %s)", -@@ -3628,6 +3815,24 @@ +@@ -3537,6 +3732,43 @@ + + fchmod(cupsFileNumber(out), 0640); + fchown(cupsFileNumber(out), RunUser, Group); ++#ifdef WITH_LSPP ++ if (getfilecon(filename, &spoolcon) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "copy_banner: Unable to get the context of the banner file %s - %s", ++ filename, strerror(errno)); ++ job->num_files --; ++ return (0); ++ } ++ tmpcon = context_new(spoolcon); ++ jobcon = context_new(con->scon); ++ freecon(spoolcon); ++ if (context_range_set(tmpcon, (context_range_get(jobcon))) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "copy_banner: Unable to set the level of the context for file %s - %s", ++ filename, strerror(errno)); ++ context_free(jobcon); ++ context_free(tmpcon); ++ job->num_files --; ++ return (0); ++ } ++ if (setfilecon(filename, context_str(tmpcon)) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "copy_banner: Unable to set the context of the banner file %s - %s", ++ filename, strerror(errno)); ++ context_free(jobcon); ++ context_free(tmpcon); ++ job->num_files --; ++ return (0); ++ } ++ cupsdLogMessage(CUPSD_LOG_DEBUG2, "copy_banner: %s set to %s", ++ filename, context_str(tmpcon)); ++ context_free(jobcon); ++ context_free(tmpcon); ++#endif /* WITH_LSPP */ + + /* + * Try the localized banner file under the subdirectory... +@@ -3631,6 +3863,24 @@ else s = attrname; @@ -1548,15 +1623,15 @@ + { + if (con->scon != NULL && strcmp(con->scon, UNKNOWN_SL) != 0) + { -+ job_context = context_new(con->scon); ++ jobcon = context_new(con->scon); + if (strcasecmp(name, MLS_CONFIG) == 0) -+ mls_label = context_range_get(job_context); ++ mls_label = context_range_get(jobcon); + else if (strcasecmp(name, TE_CONFIG) == 0) -+ mls_label = context_type_get(job_context); ++ mls_label = context_type_get(jobcon); + else // default to using the whole context string -+ mls_label = context_str(job_context); ++ mls_label = context_str(jobcon); + cupsFilePuts(out, mls_label); -+ context_free(job_context); ++ context_free(jobcon); + } + continue; + } @@ -1564,23 +1639,26 @@ if (!strcmp(s, "printer-name")) { cupsFilePuts(out, job->dest); -@@ -5353,6 +5558,15 @@ +@@ -5352,6 +5602,18 @@ cupsd_printer_t *printer; /* Printer */ cups_array_t *list; /* Which job list... */ cups_array_t *ra; /* Requested attributes array */ +#ifdef WITH_LSPP + int selinuxcheck; /* perform the SELinux access check? */ ++ char filename[1024]; /* Filename of the spool file */ + security_id_t clisid; /* SELinux SID of the client */ + security_id_t jobsid; /* SELinux SID of the job */ ++ security_id_t filesid; /* SELinux SID of the spool file */ + struct av_decision avd; /* SELinux decision stuct */ + struct avc_entry_ref avcref; /* AVC entry cache pointer */ + security_class_t tclass; /* SELinux security class */ + access_vector_t avr; /* SELinux access being queried */ ++ security_context_t spoolfilecon; /* SELinux context of the spool file */ +#endif /* WITH_LSPP */ cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs(%p[%d], %s)", con, con->http.fd, -@@ -5470,6 +5684,40 @@ +@@ -5469,6 +5731,40 @@ ra = create_requested_array(con->request); @@ -1621,7 +1699,7 @@ /* * OK, build a list of jobs for this printer... */ -@@ -5507,6 +5755,19 @@ +@@ -5506,6 +5802,42 @@ if (count > 0) ippAddSeparator(con->response); @@ -1634,14 +1712,37 @@ + avc_entry_ref_init(&avcref); + + if (avc_has_perm_noaudit(clisid, jobsid, tclass, avr, &avcref, &avd) != 0) -+ continue; ++ { ++ cupsdLogMessage(CUPSD_LOG_INFO, "get_jobs: SELinux denied access based on the client context"); ++ snprintf(filename, sizeof(filename), "%s/c%05d", RequestRoot, job->id); ++ if (getfilecon(filename, &spoolfilecon) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "get_jobs: Unable to get spoolfile context"); ++ continue; ++ } ++ if (avc_context_to_sid(spoolfilecon, &filesid) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "get_jobs: Unable to determine the SELinux sid for the spool file"); ++ freecon(spoolfilecon); ++ continue; ++ } ++ freecon(spoolfilecon); ++ if (avc_has_perm_noaudit(clisid, filesid, tclass, avr, &avcref, &avd) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_INFO, "get_jobs: SELinux denied access to the spool file"); ++ continue; ++ } ++ cupsdLogMessage(CUPSD_LOG_INFO, "get_jobs: SELinux allowed access to the spool file"); ++ } ++ else ++ cupsdLogMessage(CUPSD_LOG_INFO, "get_jobs: SELinux allowed access based on the client"); + } +#endif /* WITH_LSPP */ + count ++; cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs: count = %d", count); -@@ -7935,12 +8196,22 @@ +@@ -7944,12 +8276,22 @@ * See if we need to add the ending sheet... */ @@ -1664,8 +1765,86 @@ /* * Yes... */ ---- cups-1.2.2-8/scheduler/job.c 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/scheduler/job.c 2006-08-17 10:38:41.000000000 -0400 +@@ -9201,6 +9543,17 @@ + int userlen) /* I - Length of username */ + { + cupsd_printer_t *printer; /* Printer for job */ ++#ifdef WITH_LSPP ++ char filename[1024]; /* Job filename */ ++ struct av_decision avd; /* Pointer to the access decision */ ++ struct avc_entry_ref avcref; /* Pointer to the access vector cache */ ++ security_class_t tclass; /* Object class for the SELinux check */ ++ access_vector_t avr; /* Access method being requested */ ++ security_id_t jobsid; /* SELinux sid for the job */ ++ security_id_t consid; /* SELinux sid for the client */ ++ security_id_t filesid; /* SELinux sid for the spool file */ ++ security_context_t spoolfilecon; /* SELinux context of the spool file */ ++#endif /* WITH_LSPP */ + + + cupsdLogMessage(CUPSD_LOG_DEBUG2, +@@ -9222,6 +9575,59 @@ + + strlcpy(username, get_username(con), userlen); + ++#ifdef WITH_LSPP ++ if (is_lspp_config()) ++ { ++ if (!con->scon || !job->scon) ++ return 0; ++ ++ tclass = SECCLASS_FILE; ++ avr = FILE__READ; ++ avc_init("cupsd_validate_user_", NULL, NULL, NULL, NULL); ++ avc_entry_ref_init(&avcref); ++ if (avc_context_to_sid(job->scon, &jobsid) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "validate_user: Unable to determine the SELinux sid for the job"); ++ return 0; ++ } ++ if (avc_context_to_sid(con->scon, &consid) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "validate_user: Unable to determine the SELinux sid for the client"); ++ return 0; ++ } ++ ++ if (avc_has_perm_noaudit(consid, jobsid, tclass, avr, &avcref, &avd) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_INFO, "validate_user: SELinux denied access for the user"); ++ /* ++ * The access check failed, check access on the file ++ */ ++ snprintf(filename, sizeof(filename), "%s/c%05d", RequestRoot, job->id); ++ if (getfilecon(filename, &spoolfilecon) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "validate_user: Unable to get spoolfile context"); ++ return 0; ++ } ++ if (avc_context_to_sid(spoolfilecon, &filesid) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "validate_user: Unable to determine the SELinux sid for the spool file"); ++ freecon(spoolfilecon); ++ return 0; ++ } ++ freecon(spoolfilecon); ++ if (avc_has_perm_noaudit(consid, filesid, tclass, avr, &avcref, &avd) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_INFO, "validate_user: SELinux denied access on the spool file"); ++ return 0; ++ } ++ else ++ cupsdLogMessage(CUPSD_LOG_INFO, "validate_user: SELinux allowed access on the spool file"); ++ } ++ else ++ cupsdLogMessage(CUPSD_LOG_INFO, "validate_user: SELinux allowed access based on the client context"); ++ } ++#endif /* WITH_LSPP */ ++ + /* + * Check the username against the owner... + */ +--- cups-1.2.4-orig/scheduler/job.c 2006-09-28 11:38:08.000000000 -0400 ++++ cups-1.2.4/scheduler/job.c 2006-10-02 12:44:13.000000000 -0400 @@ -68,6 +68,9 @@ * unload_job() - Unload a job from memory. */ @@ -1676,19 +1855,22 @@ /* * Include necessary headers... */ -@@ -77,6 +80,11 @@ +@@ -77,6 +80,14 @@ #include #include +#ifdef WITH_LSPP ++#include +#include +#include -+#include ++#include ++#include ++#include +#endif /* WITH_LSPP */ /* * Local globals... -@@ -985,6 +993,23 @@ +@@ -1032,6 +1043,23 @@ cupsdSetString(&job->dest, dest); } @@ -1712,26 +1894,83 @@ job->sheets = ippFindAttribute(job->attrs, "job-media-sheets-completed", IPP_TAG_INTEGER); job->job_sheets = ippFindAttribute(job->attrs, "job-sheets", IPP_TAG_NAME); -@@ -2428,6 +2453,18 @@ - int remote_job; /* Remote print job? */ +@@ -1341,6 +1369,11 @@ + { + char filename[1024]; /* Job control filename */ + cups_file_t *fp; /* Job file */ ++#ifdef WITH_LSPP ++ security_context_t spoolcon; /* context of the job control file */ ++ context_t jobcon; /* contex_t container for job->scon */ ++ context_t tmpcon; /* temp context to swap the level */ ++#endif /* WITH_LSPP */ + + + cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdSaveJob(job=%p(%d)): job->attrs=%p", +@@ -1359,6 +1392,41 @@ + fchmod(cupsFileNumber(fp), 0600); + fchown(cupsFileNumber(fp), RunUser, Group); + ++#ifdef WITH_LSPP ++ if (getfilecon(filename, &spoolcon) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "Unable to get context of job control file \"%s\" - %s.", ++ filename, strerror(errno)); ++ return; ++ } ++ jobcon = context_new(job->scon); ++ tmpcon = context_new(spoolcon); ++ freecon(spoolcon); ++ if (context_range_set(tmpcon, (context_range_get(jobcon))) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "Unable to set the range for job control file \"%s\" - %s.", ++ filename, strerror(errno)); ++ context_free(tmpcon); ++ context_free(jobcon); ++ return; ++ } ++ if (setfilecon(filename, context_str(tmpcon)) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "Unable to set context of job control file \"%s\" - %s.", ++ filename, strerror(errno)); ++ context_free(tmpcon); ++ context_free(jobcon); ++ return; ++ } ++ cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdSaveJob(job=%p): new spool file context=%s", ++ job, context_str(tmpcon)); ++ context_free(tmpcon); ++ context_free(jobcon); ++#endif /* WITH_LSPP */ ++ + job->attrs->state = IPP_IDLE; + + if (ippWriteIO(fp, (ipp_iocb_t)cupsFileWrite, 1, NULL, +@@ -2487,6 +2555,21 @@ + /* RIP_MAX_CACHE env variable */ static char *options = NULL;/* Full list of options */ static int optlength = 0; /* Length of option buffer */ +#ifdef WITH_LSPP -+ int acstatus = 0; /* return value of the access check */ -+ pid_t acpid = -1; /* pid for the access check */ + const char *mls_label = NULL; /* SL to put in classification env var */ + char *label_template = NULL; /* SL to put in classification env var */ + char *audit_message = NULL; /* Audit message string */ + char *printerfile = NULL; /* Device file pointed to by the printer */ -+ char *acargv[3]; /* Command line args */ -+ char buffer[1024] = {0}; /* argv[0] buffer */ -+ char *acenvp[MAX_ENV]; /* Environment */ -+ context_t job_context; /* SELinux context of the job */ ++ context_t jobcon; /* SELinux context of the job */ ++ security_id_t clisid; /* SELinux SID for the client */ ++ security_id_t psid; /* SELinux SID for the printer */ ++ context_t printercon; /* Printer's context string */ ++ security_context_t devcon; /* Printer's SELinux context */ ++ struct av_decision avd; /* Pointer to the access decision */ ++ struct avc_entry_ref avcref; /* Pointer to the access vector cache */ ++ security_class_t tclass; /* Object class for the SELinux check */ ++ access_vector_t avr; /* Access method being requested */ +#endif /* WITH_LSPP */ cupsdLogMessage(CUPSD_LOG_DEBUG2, "start_job: id = %d, file = %d/%d", -@@ -2709,6 +2746,69 @@ +@@ -2740,6 +2823,77 @@ cupsdLogMessage(CUPSD_LOG_DEBUG, "banner_page = %d", banner_page); @@ -1742,57 +1981,65 @@ + * Perform an access check before printing, but only if the printer starts with /dev/ + */ + printerfile = strstr(printer->device_uri, "/dev/"); ++ if (printerfile == NULL && (strncmp(printer->device_uri, "file:/", 6) == 0)) ++ printerfile = strdup(printer->device_uri + strlen("file:/")); + + if (printerfile != NULL) + { -+ cupsdLogMessage(CUPSD_LOG_DEBUG, "StartJob: Attempting to check access on printer device %s", -+ printerfile); -+ -+ if (setexeccon(job->scon) != 0) ++ cupsdLogMessage(CUPSD_LOG_DEBUG, ++ "StartJob: Attempting to check access on printer device %s", printerfile); ++ tclass = SECCLASS_FILE; ++ avr = FILE__WRITE; ++ avc_init("cupsd_dequeue_", NULL, NULL, NULL, NULL); ++ avc_entry_ref_init(&avcref); ++ if (avc_context_to_sid(job->scon, &clisid) != 0) + { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "StartJob: Unable to setexeccon to %s", job->scon); ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "StartJob: Unable to determine the SELinux sid for the job"); + cupsdCancelJob(job, 0, IPP_JOB_ABORTED); -+ return; ++ return ; + } ++ if (getfilecon(printerfile, &devcon) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "StartJob: Unable to get the SELinux context of %s", ++ printerfile); ++ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); ++ return ; ++ } ++ printercon = context_new(devcon); ++ cupsdLogMessage(CUPSD_LOG_DEBUG, "StartJob: printer context %s client context %s", ++ context_str(printercon), job->scon); ++ context_free(printercon); + -+ snprintf(buffer, sizeof(buffer), "%s/daemon/lspp-access", ServerBin); -+ acargv[0] = "lspp-access"; -+ acargv[1] = printerfile; -+ acargv[2] = NULL; -+ -+ cupsdLoadEnv(acenvp, (int)(sizeof(acenvp) / sizeof(acenvp[0]))); ++ if (avc_context_to_sid(devcon, &psid) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "StartJob: Unable to determine the SELinux sid for the printer"); ++ freecon(devcon); ++ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); ++ return ; ++ } ++ freecon(devcon); + -+ if (!cupsdStartProcess(buffer, acargv, acenvp, -1, -1, -1, -1, 0, &acpid)) ++ if (avc_has_perm_noaudit(clisid, psid, tclass, avr, &avcref, &avd) != 0) + { -+ waitpid(acpid, &acstatus, 0); -+ if (WIFEXITED(acstatus)) ++ /* ++ * The access check failed, so cancel the job and send an audit message ++ */ ++ if (AuditLog != -1) + { -+ if (WEXITSTATUS(acstatus) != 0) -+ { -+ /* -+ * The access check failed, so cancel the job and send an audit message -+ */ -+ if (AuditLog != -1) -+ { -+ audit_message = NULL; -+ cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s obj=%s cancelled," -+ " unable to access printer=%s", -+ job->id, job->auid, job->username, job->scon, printer->name); -+ audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message, -+ ServerName, NULL, NULL, 0); -+ free(audit_message); -+ } -+ -+ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); -+ -+ return; -+ } -+ else -+ { -+ cupsdLogMessage(CUPSD_LOG_DEBUG, "StartJob: access check succeeded (returned %d)", -+ WEXITSTATUS(acstatus)); -+ } ++ audit_message = NULL; ++ cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s obj=%s canceled" ++ " unable to access printer=%s", job->id, ++ job->auid, (job->username)?job->username:"?", job->scon, printer->name); ++ audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message, ++ ServerName, NULL, NULL, 0); ++ free(audit_message); + } ++ ++ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); ++ ++ return ; + } + } + } @@ -1801,7 +2048,7 @@ /* * Building the options string is harder than it needs to be, but * for the moment we need to pass strings for command-line args and -@@ -3041,6 +3141,61 @@ +@@ -3069,7 +3223,66 @@ snprintf(classification, sizeof(classification), "CLASSIFICATION=%s", attr->values[0].string.text); @@ -1822,7 +2069,7 @@ + } + else + { -+ job_context = context_new(job->scon); ++ jobcon = context_new(job->scon); + + if ((attr = ippFindAttribute(job->attrs, "job-sheets", IPP_TAG_NAME)) == NULL) + label_template = strdup(Classification); @@ -1833,38 +2080,43 @@ + label_template = strdup(attr->values[0].string.text); + + if (strcasecmp(label_template, MLS_CONFIG) == 0) -+ mls_label = context_range_get(job_context); ++ mls_label = context_range_get(jobcon); + else if (strcasecmp(label_template, TE_CONFIG) == 0) -+ mls_label = context_type_get(job_context); ++ mls_label = context_type_get(jobcon); + else if (strcasecmp(label_template, SELINUX_CONFIG) == 0) -+ mls_label = context_str(job_context); -+ -+ if (!mls_label) ++ mls_label = context_str(jobcon); ++ else + mls_label = label_template; + -+ snprintf(classification, sizeof(classification), "CLASSIFICATION=%s", mls_label); ++ if (mls_label) ++ snprintf(classification, sizeof(classification), "CLASSIFICATION=%s", mls_label); ++ else ++ bzero(classification, sizeof(classification)); + + if (AuditLog != -1) + { + audit_message = NULL; + cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s printer=%s title=%s" + " obj=%s label=%s", job->id, job->auid, job->username, -+ printer->name, title, job->scon, mls_label); ++ printer->name, title, job->scon, mls_label?mls_label:"none"); + audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message, + ServerName, NULL, NULL, 1); + free(audit_message); + } -+ context_free(job_context); ++ context_free(jobcon); + free(label_template); + } + } -+#endif /* WITH_LSPP */ -+ ++ if (classification) ++ envp[envc ++] = classification; ++#else /* !WITH_LSPP */ envp[envc ++] = classification; ++#endif /* WITH_LSPP */ } ---- cups-1.2.2-8/scheduler/job.h 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/scheduler/job.h 2006-08-07 06:19:33.000000000 -0400 + if (job->dtype & (CUPS_PRINTER_CLASS | CUPS_PRINTER_IMPLICIT)) +--- cups-1.2.4-orig/scheduler/job.h 2006-09-19 16:11:08.000000000 -0400 ++++ cups-1.2.4/scheduler/job.h 2006-09-28 16:31:29.000000000 -0400 @@ -22,6 +22,13 @@ * WWW: http://www.cups.org */ @@ -1890,67 +2142,8 @@ } cupsd_job_t; ---- cups-1.2.2-8/scheduler/lspp-access.c 1969-12-31 19:00:00.000000000 -0500 -+++ cups-1.2.2/scheduler/lspp-access.c 2006-08-07 06:19:33.000000000 -0400 -@@ -0,0 +1,56 @@ -+/* -+ * Copyright (C) Hewlett-Packard Development Company, L.P., 2006 -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation; either version 2 of the License, or -+ * (at your option) any later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See -+ * the GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program; if not, write to the Free Software -+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA -+ * -+ * Contents: -+ * -+ * main() - Main entry for the access checker. -+ */ -+ -+#include -+#include -+#include -+ -+int main(int argc, char *argv[]) { -+ int status = -1; -+ char filename[FILENAME_MAX+1] = {0}; -+ -+ if (argc < 2) -+ { -+ printf("Check for access to which file? "); -+ scanf("%s", (char *)&filename); -+ } -+ else -+ { -+ strncpy(filename, argv[1], FILENAME_MAX); -+ } -+ -+ status = access(filename, R_OK|W_OK); -+ -+ if (argc < 2) -+ { -+ /* -+ * Assume the user would like to hear the answer on the terminal -+ * since the filename was received interactively. -+ */ -+ if (status != 0) -+ printf("Unable to access that file.\n"); -+ else -+ printf("Access Granted\n"); -+ } -+ -+ return status; -+} ---- cups-1.2.2-8/scheduler/main.c 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/scheduler/main.c 2006-08-15 09:15:28.000000000 -0400 +--- cups-1.2.4-orig/scheduler/main.c 2006-09-28 11:38:08.000000000 -0400 ++++ cups-1.2.4/scheduler/main.c 2006-09-28 16:31:29.000000000 -0400 @@ -47,6 +47,8 @@ * usage() - Show scheduler usage. */ @@ -2018,48 +2211,8 @@ return (!stop_scheduler); } ---- cups-1.2.2-8/scheduler/Makefile 2006-08-10 11:43:02.000000000 -0400 -+++ cups-1.2.2/scheduler/Makefile 2006-08-07 06:19:33.000000000 -0400 -@@ -54,6 +54,7 @@ - OBJS = \ - $(CUPSDOBJS) \ - $(MIMEOBJS) \ -+ lspp-access.o \ - cups-deviced.o \ - cups-driverd.o \ - cups-lpd.o \ -@@ -63,6 +64,7 @@ - testspeed.o \ - util.o - TARGETS = \ -+ lspp-access \ - cupsd \ - cups-deviced \ - cups-driverd \ -@@ -111,11 +113,12 @@ - $(INSTALL_DIR) -m 755 $(SERVERBIN) - echo Creating $(SERVERBIN)/daemon... - $(INSTALL_DIR) -m 755 $(SERVERBIN)/daemon -- echo Installing cups-deviced, cups-driverd, cups-lpd, and cups-polld in $(SERVERBIN)/daemon... -+ echo Installing cups-deviced, cups-driverd, cups-lpd, cups-polld, and lspp-access in $(SERVERBIN)/daemon... - $(INSTALL_BIN) cups-deviced $(SERVERBIN)/daemon - $(INSTALL_BIN) cups-driverd $(SERVERBIN)/daemon - $(INSTALL_BIN) cups-lpd $(SERVERBIN)/daemon - $(INSTALL_BIN) cups-polld $(SERVERBIN)/daemon -+ $(INSTALL_BIN) lspp-access $(SERVERBIN)/daemon - echo Creating $(SERVERBIN)/driver... - $(INSTALL_DIR) -m 755 $(SERVERBIN)/driver - echo Creating $(SERVERROOT)... -@@ -161,6 +164,7 @@ - $(RM) $(SERVERBIN)/daemon/cups-driverd - $(RM) $(SERVERBIN)/daemon/cups-lpd - $(RM) $(SERVERBIN)/daemon/cups-polld -+ $(RM) $(SERVERBIN)/daemon/lspp-access - -$(RMDIR) $(STATEDIR)/certs - -$(RMDIR) $(STATEDIR) - -$(RMDIR) $(SERVERROOT)/ppd ---- cups-1.2.2/scheduler/printers.c.lspp 2006-08-24 12:28:38.000000000 +0100 -+++ cups-1.2.2/scheduler/printers.c 2006-08-24 12:30:49.000000000 +0100 +--- cups-1.2.4-orig/scheduler/printers.c 2006-09-28 11:38:08.000000000 -0400 ++++ cups-1.2.4/scheduler/printers.c 2006-10-02 15:58:22.000000000 -0400 @@ -57,6 +57,8 @@ * printing desktop tools. */ @@ -2094,7 +2247,7 @@ DEBUG_printf(("cupsdSetPrinterAttrs: entering name = %s, type = %x\n", p->name, -@@ -1579,6 +1592,37 @@ +@@ -1579,6 +1592,42 @@ attr->values[1].string.text = _cupsStrAlloc(Classification ? Classification : p->job_sheets[1]); } @@ -2105,21 +2258,26 @@ + rangestr = NULL; + printercon = 0; + printerfile = strstr(p->device_uri, "/dev/"); ++ if (printerfile == NULL && (strncmp(p->device_uri, "file:/", 6) == 0)) ++ printerfile = strdup(p->device_uri + strlen("file:/")); + + if (printerfile != NULL) + { + if (getfilecon(printerfile, &devcon) == -1) -+ cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdSetPrinterAttrs: Unable to get printer context"); ++ cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdSetPrinterAttrs: Unable to get printer context"); + else ++ { + printercon = context_new(devcon); ++ freecon(devcon); ++ } + } + + if (printercon && context_range_get(printercon)) -+ rangestr = strdup(context_range_get(printercon)); ++ rangestr = strdup(context_range_get(printercon)); + else + rangestr = strdup("unknown"); + -+ cupsdSetStringf(&audit_message, "[Config] printer=%s uri=%s banners set to %s %s has range %s", ++ cupsdSetStringf(&audit_message, "printer=%s uri=%s banners=%s,%s range=%s", + p->name, p->device_uri, p->job_sheets[0], p->job_sheets[1], rangestr); + audit_log_user_message(AuditLog, AUDIT_LABEL_LEVEL_CHANGE, audit_message, + ServerName, NULL, NULL, 1); diff --git a/cups.spec b/cups.spec index b298a09..60be8bf 100644 --- a/cups.spec +++ b/cups.spec @@ -6,7 +6,7 @@ Summary: Common Unix Printing System Name: cups Version: 1.2.4 -Release: 4 +Release: 5 License: GPL Group: System Environment/Daemons Source: ftp://ftp.easysw.com/pub/cups/%{version}/cups-%{version}-source.tar.bz2 @@ -366,9 +366,6 @@ rm -rf $RPM_BUILD_ROOT %{cups_serverbin}/backend %{cups_serverbin}/cgi-bin %dir %{cups_serverbin}/daemon -%if %lspp -%{cups_serverbin}/daemon/lspp-access -%endif %{cups_serverbin}/daemon/cups-polld %{cups_serverbin}/daemon/cups-deviced %{cups_serverbin}/daemon/cups-driverd @@ -416,6 +413,9 @@ rm -rf $RPM_BUILD_ROOT %{cups_serverbin}/daemon/cups-lpd %changelog +* Tue Oct 3 2006 Tim Waugh 1:1.2.4-5 +- Updated LSPP patch from Matt Anderson (bug #208676). + * Sun Oct 01 2006 Jesse Keating - 1:1.2.4-4 - rebuilt for unwind info generation, broken in gcc-4.1.1-21